9107c6fc44fe5e27a886851beb14eb033cb74e555bf3fb02517caae74d796e0e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:17

Target

11ed9fb65947b0be0e4165144ba2a507.dll
Size

58KB
MD5

11ed9fb65947b0be0e4165144ba2a507
SHA1

8555f213c0ea839339604226fa99969485cc1807
SHA256

9107c6fc44fe5e27a886851beb14eb033cb74e555bf3fb02517caae74d796e0e
SHA512

76a535a321f7b4b4b878ba7dc1e8ee100776867bbbbe9fc6d26c9e2ad846a8b631ca88028c3d62a1431432bbde7477572b6d2462ca00bc0f113d04b00f629799
SSDEEP

1536:agF0eiyUcbhrHLlUk2nX2tdgUhHhenDayB2UzfG3Jq6K:t2yFNHxUk2+dZdhenGyBXz2VK

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2188-0-0x0000000010000000-0x0000000010011000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2188	2416	rundll32.exe	14
PID 2416 wrote to memory of 2188	2416	rundll32.exe	14
PID 2416 wrote to memory of 2188	2416	rundll32.exe	14
PID 2416 wrote to memory of 2188	2416	rundll32.exe	14
PID 2416 wrote to memory of 2188	2416	rundll32.exe	14
PID 2416 wrote to memory of 2188	2416	rundll32.exe	14
PID 2416 wrote to memory of 2188	2416	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11ed9fb65947b0be0e4165144ba2a507.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\11ed9fb65947b0be0e4165144ba2a507.dll,#1
  2⤵
  PID:2188

memory/2188-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download